AZ-204 Develop for Azure storage Practice Question
You have an Azure Storage account that contains a blob container with thousands of small files. You need to generate a URL that allows users to download a single file for a limited time without changing the storage account's firewall rules or requiring authentication. Which approach should you use?
⚠ Common exam trap
Many candidates confuse a container-level SAS or public access with a service-level SAS, or mistakenly think RBAC roles can provide anonymous access, when in fact only a blob-level SAS meets the exact constraints of time-limited, single-file, no-authentication access without altering firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Shared Access Signature (SAS) for the specific blob with a time limit
A Shared Access Signature (SAS) for a specific blob provides delegated, time-limited access to that blob without requiring the storage account key or changing firewall rules. By generating a SAS token with a defined expiration time and attaching it to the blob URL, users can download the file directly via HTTPS while the storage account remains secured behind its firewall and authentication requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Shared Access Signature (SAS) for the specific blob with a time limit
Why this is correct
Creating a Shared Access Signature (SAS) for the specific blob is the correct approach because it generates a URI that grants secure, time-limited, and granular access to that single resource. This cryptographically signed token allows the user to directly access the blob via the provided URL without needing to authenticate with their own credentials or be a registered Microsoft Entra ID user. The SAS can be configured with precise permissions (e.g., read-only) and an expiration time, ensuring access is temporary and restricted to only what is necessary.
- ✗
Provide the storage account key to the user so they can authenticate
Why it's wrong here
Providing the storage account key to the user is a severe security risk as it grants full administrative control over the entire storage account, including all containers, blobs, files, queues, and tables. This key bypasses all granular access controls and allows for unrestricted operations, such as deleting all data or modifying account settings. It is never recommended to share the account key for specific, limited access requirements due to the principle of least privilege.
- ✗
Assign the user an RBAC role (e.g., Storage Blob Data Reader) and have them authenticate via Microsoft Entra ID
Why it's wrong here
Assigning an Azure Role-Based Access Control (RBAC) role, such as Storage Blob Data Reader, requires the user to be a Microsoft Entra ID identity (user, group, or service principal) and to authenticate using their Microsoft Entra ID credentials. This method explicitly contradicts the implicit requirement of providing access without requiring the user to perform an authentication step themselves when accessing the resource. RBAC is ideal for managing access for known identities within an organization, but not for anonymous or unauthenticated access.
- ✗
Set the blob container's public access level to Blob (anonymous read access for blobs)
Why it's wrong here
Setting the blob container's public access level to 'Blob' would make all current and future blobs within that specific container anonymously readable by anyone on the internet, indefinitely. This approach lacks the necessary granularity to restrict access to only a single, specific file within the container. Furthermore, it does not provide any mechanism for time-limiting the access, making it unsuitable for a scenario requiring temporary access to an individual blob.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.